The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
0answers
15 views

Distributed Shared Secret for RNG that only Distributor knows?

For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
5
votes
3answers
121 views

Best practice for sharing a (.zip) file password with recipient

When sharing confidential documents, it's common to zip up and encrypt the files with a good password. However, all too often the file is emailed as an attachment with the password in the body of the ...
1
vote
1answer
69 views

Key rotation for shared secret keys - recommendation

When using software that does encryption using shared secrets what are the recommended practices for changing the keys. To be specific, this is a distributed software running in a cluster and the ...
0
votes
0answers
20 views

OAuth2 storing the shared-secret on a owned-server - how does it prevent abuse?

(This question assumes that all communication takes place on a SSL (TLS) secured connection. It also assumes that the third-party client doesn't have it's own user management.) I've read quite some ...
0
votes
1answer
27 views

Share private key with expiry period

I'd like a way to encrypt my data, and temporarily share access to 'semi-trusted' parties. If I encrypt my data with my private key, is it possible to share my private key (or some derivative of it)...
1
vote
1answer
35 views

sharing a password for short term access to a shared resource

I sometimes need to delegate access to a single-user/shared user website for short term administration purposes (eg. with a junior administator for programmed maintenance). I have requested multiple ...
1
vote
0answers
47 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
137
votes
8answers
15k views

How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?

I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
1
vote
1answer
73 views

Is it safe to publish my development private key?

For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine. Private key: server.key Certificate signing request: ...
6
votes
2answers
322 views

What is the best strategy to store and share pem files between team?

Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
0
votes
0answers
86 views

Hashing Identifiers to Create Pseudonyms

I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.: ...
2
votes
2answers
121 views

What can I do to increase the security of my app based on a shared secret?

I'm working on an app that will run on a users TV and has a companion mobile app. I wanted to present a QR code to my users from the the TV app, which is then scanned by the companion mobile app's ...
10
votes
3answers
1k views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app traffic....
2
votes
1answer
357 views

Is it a safe to hardcode my secret key in my iOS app?

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code. Isn't that a security vulnerability since string literals can be extracted from the app binary, e....
72
votes
5answers
8k views

Why can't I MitM a Diffie-Hellman key exchange?

After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack. Given the ...
2
votes
0answers
87 views

Simple method requiring no installation of special tools to share a file over the internet

I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools. This is a very common use case. For example, I want to ...
40
votes
6answers
5k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
1
vote
1answer
107 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
2
votes
1answer
215 views

Shamir's Secret Sharing Scheme - how standardised?

I tested the 'ssss' package in Linux, an implementation of Shamir's secret sharing algorithm. link The package is easy to use, and I presume that it is cryptographically valid implementation, though ...
1
vote
0answers
185 views

Problem in understanding Blakley's Secret Sharing Scheme

I need to implement Blakley's Secret Sharing Scheme. I have read below mentioned two research papers but still unable to understand how to implement it. 1. Safeguarding cryptographic keys 2. Two ...
5
votes
3answers
483 views

Bash command argument security

Suppose I want to call a program that takes in a username and password to start. What are the risks with calling the program like ./prog --user 'User' --password 'Password' other than the obvious leak ...
0
votes
1answer
295 views

Chat encryption system avoiding protocol sniffing and then key+decryption replay?

I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is ...
0
votes
1answer
314 views

Using hashed password as secret key for hmac to avoid exchange of secret between server and client

I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with ...
1
vote
4answers
329 views

Elliptic curve cryptography and key sharing

I want to know if it is possible in Elliptic curve cryptography to have 2 parties holding a part of the private key. The idea is to encrypt (for DSA) data with the 2 sub keys without any of the party ...
4
votes
4answers
4k views

How to securely share key between two remote devices?

Assuming I have a server/client topology, currently I'm facing the problem that I want to generate some key on the client side and somehow make the remote server get it securely. I'm using AES on ...
2
votes
1answer
113 views

What to do with the shared secret?

I've been using Diffie-Hellman (although, now looking into SRP) for sending data encrypted between two hosts. After the initial handshake, both the end hosts have generated the same shared secret. So, ...
4
votes
3answers
246 views

Governement like classified information system

I need to implement a classification system for my company, similar to the government's. I'm working for a company working with the government. The classification system in my country isn't public so ...
2
votes
1answer
118 views

Layered email encryption with multiple private keys on separate media

I'd like to encrypt e-mail messages so that multiple physically separated keys are needed to decrypt them. For example, I'd like to have three private keys stored on different media, as in: key A ...
3
votes
1answer
441 views

How do shared folders work with Lastpass

I was wondering how the concept of shared folders work with Lastpass. As I understand from their site, Lastpass has a master password, which acts as the encryption key (say MK) for all data stored in ...
8
votes
2answers
2k views

Encrypting something with multiple keys such that k out of n keys are needed; what's it called?

I am trying to find information on how to encrypt something in such a way that there are n keys, and k of them are needed for decryption. However, I have been searching Google for half an hour but ...
3
votes
2answers
391 views

Is splitting up an AES Key a problem?

I'm wondering if it would be a problem to split up a 256 bit AES-Key into two 16-Byte blocks and distribute it, to implement some kind of a four-eyes-principle (you need two persons to decrypt a ...
6
votes
3answers
207 views

What would be the application-level equivalent of dynamic communication secrets?

I'm probably just thick and sufficiently new to security related issues in software development, but since I can't find information and I've been stuck on Googling this for a while. Recently I came ...
4
votes
1answer
881 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...